CVE-2025-53367

Published Jul 3, 2025

Last updated 7 months ago

CVSS high 8.4
Ubuntu
Supply chain

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-53367 is an out-of-bounds write vulnerability affecting DjVuLibre, a GPL implementation of the DjVu format, in versions prior to 3.5.29. The vulnerability lies within the `MMRDecoder::scanruns` method, which fails to properly validate the bounds of the `xr` pointer, potentially leading to writes beyond the allocated memory buffer. This can result in heap corruption. An out-of-bounds read with `pr` is also possible due to similar boundary checking issues. Successful exploitation of this vulnerability could allow an attacker to craft a malicious DjVu document that triggers heap corruption. This may lead to arbitrary memory writes, potentially enabling remote code execution, system compromise, or application crashes. Version 3.5.29 of DjVuLibre contains a patch that addresses this vulnerability.

Description
DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is affected by an OOB-write vulnerability, because it does not check that the xr pointer stays within the bounds of the allocated buffer. This can lead to writes beyond the allocated memory, resulting in a heap corruption condition. An out-of-bounds read with pr is also possible for the same reason. This issue has been patched in version 3.5.29.
Source
security-advisories@github.com
NVD status
Deferred

Risk scores

CVSS 4.0

Type
Secondary
Base score
8.4
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
HIGH

Weaknesses

security-advisories@github.com
CWE-125

Social media

Hype score
Not currently trending

  1. #VulnerabilityReport #CVE202553367 CVE-2025-53367: DjVuLibre Vulnerability Opens Path to Linux Desktop Code Execution, PoC Available! https://t.co/xC2LRZryHS

    @Komodosec

    11 Aug 2025

    44 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. URGENT: DjVuLibre vulns (CVE-2021-46310, CVE-2025-53367) in Debian 11 allow RCE via malicious files. ✅ Patch: sudo apt upgrade djvulibre-bin Read more:👉 https://t.co/CeLrzMneaN #InfoSec #CVE #SysAdmin https://t.co/q8oCKqMzWk

    @Cezar_H_Linux

    22 Jul 2025

    41 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. CVE-2025-53367: An exploitable out-of-bounds write in DjVuLibre https://t.co/nDZXzP6GrE #GitHub #Git https://t.co/FXwth7Zqfi

    @lopezunwired

    7 Jul 2025

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Linux環境で使用されるDjVu文書形式のデコーダ「DjVuLibre」に深刻な脆弱性（CVE-2025-53367）が発見された。MMRDecoder::scanrunsメソッドにおけるバッファ境界外書き込みが原因で、細工されたDjVuファイル（.pdfに偽装可

    @yousukezan

    5 Jul 2025

    595 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. A flaw (CVE-2025-53367, CVSS 8.4) in DjVuLibre allows remote code execution on Linux via out-of-bounds write. PoC is available; patch to v3.5.29 immediately. #DjVuLibre #LinuxSecurity #RCE #Cybersecurity #Vulnerability https://t.co/bMuwK2D2Dj

    @Daily_CyberSec

    5 Jul 2025

    271 Impressions

    0 Retweets

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. #Linux: #DjVuLibre vulnerability CVE-2025-53367 could be exploited to gain code execution on a Linux Desktop system when the user tries to open a crafted PDF document. The POC works on a fully up-to-date Ubuntu 25.04 (x86_64): 👇 https://t.co/GHDLBY8iab

    @securestep9

    4 Jul 2025

    60 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-53367: An exploitable out-of-bounds write that works on a fully up-to-date Ubuntu 25.04 https://t.co/4XP7K0juAV

    @Nosoynadiemas

    3 Jul 2025

    1851 Impressions

    10 Retweets

    30 Likes

    19 Bookmarks

    1 Reply

    0 Quotes

  8. CVE-2025-53367 DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method is aff… https://t.co/eyzy7cPV05

    @CVEnew

    3 Jul 2025

    669 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Google Brotli Unchecked Return Value Vulnerability•CVE-2026-111497
  2. In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req() read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed. Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are processed without holding the listener lock, so nothing prevents the child socket from being freed while the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old one. Another cpu holding a reference on the old request socket can still be using these options (sending a SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.•CVE-2026-98432
  3. Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer and the retransmission overwrites the internal state the suspended write needs to resume correctly. Impact summary: The retransmitted message can disclose a heap memory to the peer as plaintext handshake data or cause a crash and a Denial of Service when the read reaches an unmapped memory region. CWE: CWE-125: Out-of-bounds Read Description: DTLS handshake messages can be written out in multiple fragments, and a write can suspend mid-message (returning WANT_WRITE) if the underlying transport temporarily cannot accept more data. While such a write is suspended, the DTLS retransmission timer may independently fire and ask the retransmission logic to resend an earlier, already-acknowledged-as-sent message from its retransmit queue. The retransmission logic reused the same internal buffer and position tracking as the message that was still being written, without resetting the position back to the start of the message being retransmitted. As a result the retransmission was read starting from wherever the suspended write had left off, producing a mislabelled message whose body was leftover bytes from the other, larger message still in flight - content that was never meant to be sent at that point, and which could run past the end of the allocated buffer. Separately, even when the retransmission is positioned correctly, allowing it to run to completion while another write is suspended overwrites the same shared bookkeeping that the suspended write depends on to resume. When the application later resumes the suspended write (via a subsequent SSL_read(), SSL_write(), SSL_accept(), or SSL_connect() call), it finds that bookkeeping in a state inconsistent with the message and aborts the process in a debugging build. The fix resets the retransmission's read position to the start of the message before resending, and skips retransmission entirely whenever a handshake write is still suspended, deferring to the next call that resumes it instead. FIPS impact: no The affected code is outside the FIPS module boundary.•CVE-2026-84782
  4. ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.•CVE-2024-58386
  5. Apple Multiple Products Out-of-Bounds Write Vulnerability•CVE-2026-86950

References

Sources include official advisories and independent security research.